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Handover specs [1] 

• Interface between Communications Service 
Provider (CSP) and Law Enforcement Agency 
(LEA) 

• Describes: 

- How to encapsulate intercepted packets 

- What additional information to add (headers) 

- (Optionally) how to encrypt the packets 

• Does not describe how to obtain the 
intercepted packets 
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Handover specs [2] 

• Specifications use ASN.l (Abstract Syntax 
Notation 1) encoding 

• ASN.l makes it 

- easy to write a specification 

- easy to implement the specification 
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Example ASN.l statement 



EmaillRI 



: := SEQUENCE 



-- EmaillRI is the 


PDU sent for each 


"piece" of E-mail IRI . 


emaillRIOb j Id 




[0] 


RELATIVE-OID, 


eventType 




[1] 


E-mail -Event, 


client-Address 




[2] 


IPAddress OPTIONAL, 


-- Provided if 


available 






server-Address 




[3] 


IPAddress OPTIONAL, 


-- Provided if 


available 






client- Port 




[4] 


INTEGER OPTIONAL, 


-- Provided if 


available 






server-Port 




[5] 


INTEGER OPTIONAL, 


-- Provided if 


available 






server-Octets -Sent 




[6] 


INTEGER, 


client-Octets-Sent 




[7] 


INTEGER, 


protocol-ID 




[8] 


E-mai 1 -Protocol , 


e-mail -Sender 




[9] 


UTF8String (SIZE (0..255) 


-- Not available in some cases; 


if a value is available, it must 



e-mail -Recipients [10] E-mail-Address-List OPTIONAL, 

-- Not available is some cases; if a value is available, it must be provided 
status [11] E-mail-Status, 

total -Recipient- Count [12] INTEGER (0 .. 4294967295) OPTIONAL, 

message-ID [13] OCTET STRING OPTIONAL, 

-- Network byte order 
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Old Document Numbering 



TS 102 232 



TS 102 234 



TS 102 815 



TS 102 233 



Etc. 



Etc 
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New Document Numbering 



(Since december 2006) 



• Main document: TS 102 232 
part 1 

• 6 subdocuments: part 2 to 7 

• Easy to remember! 
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The Big Picture 



SSD 

for 

e-mail 

Service 


SSD 

for 

IP 




SSD 

for 

L2 

intercept 


SSD 

for 

IP 

Multimedia 

Services 


SSD 

for 

PSTN / 
ISDN 


SSD 

for 

mobile 


part 2 


part 3 


part 4 


part 5 


part 6 


part 7 



SSD -> Service-Specific Details on top 



Generic Headers 



Handover manager 
Delivery session 

Transport layer 

Network layer 



Delivery network 

TS 102 232 part 1 
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TS 102 232 part 1 



• Scope: General handover fra 

• Covers: 

• Generic headers 

• Transport to LEA 

• HI2 or IRI: Interception Relate 
CC: Content of Communicatio 

• Rapporteur: Matthew Brown 
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TS 102 232 part 2 

• Scope: Electronic mail 

• Covers: 

- E-mail from and to the target (SMTP) 

- Mailbox retrieval by the target (POP3) 

- Mailbox manipulation by the target (IMAP) 

• Rapporteur: Mark Lastdrager (Pine Digital 
Security) 
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TS 102 232 part 3 

• Scope: internet access 

• Covers: 

• xDSL 

• Dial-up 

• Cable 

• Fixed internet 

• Rapporteur: Mark Lastdrager (Pine Digital 
Security) 
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TS 102 232 part 3 [wifi] 



• TR 102 519 contains recommendations 

- Update part 3 to include geo location 

• Two ways of interception: 



From the air (not easy or even impossible) 

On the wire (easy, but WLAN traffic may be 
masqueraded) 
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• Scope: layer 2 
service 



• Covers: 

— xDSL (on L2 level) 
-ATM 

• Rapporteur: 
Wolfgang 
Schumacher (DT) 
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TS 102 232 part 5 

• Scope: IP Multimedia (Voice/Video over IP) 

• Covers: 

• Signaling 

• Media 

• Rapporteur: Mark Lastdrager (Pine Digital 
Security) 
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TS 102 232 part 6 

• Scope: PSTN/ISDN (including emulation) 

• Covers: 

- delivery of "old world" telephony in "new world" 
IP handover standard 

• Rapporteur: Mark Shepherd (Detica/Home 
Office) 
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TS 102 232 part 7 

• Scope: mobile services 

• Covers: 

- Handover of 3GPP data in 102 232 framework 

• Circuit switched IRI 

• Mobile packet IRI/CC 

• Mobile multimedia IRI/CC 

• Rapporteur: Mark Shepherd (Detica/Home 
Office) 
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Spec testing [2] 

• Plugtest 2: 

- Lannion, France 

- Tested specs: 

• TS 102 671 (PSTN/ISDN) 

• Part 2 

• Part 5 

• Part 6 

- No official CRs were made 
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Thanks! 

mark@lawfulinterception.com 
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